Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/21/2012
10:55 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Microsoft Names Finalists In Contest For New Security Defenses

Three BlueHat Prize contestants invented ways to mitigate attacks exploiting memory-safety vulnerabilities

Microsoft today named the three finalists among 20 contestants for its first-ever BlueHat Prize for the most innovative defense technique against memory-safety exploitation attacks.

BlueHat is Microsoft's alternative to bug bounties, instead challenging researchers to come up with new ways to mitigate exploits rather than find new bugs. Microsoft first announced the contest at Black Hat 2011 in Las Vegas, saying it would offer more than $250,000 in cash and prizes to contestants who came up with new ways to mitigate exploits specifically aimed at memory-safety vulnerabilities.

The top three contestants submitted entries to thwart attacks that leverage return-oriented programming (ROP), a method used by attackers to employ short snippets of benign code in a system for nefarious purposes. The grand prize winner will be named during Microsoft's Researcher Appreciation Party on July 26 at Black Hat USA in Las Vegas.

Researcher Jared DeMott, who teaches a popular application security course at security conferences, came up with a method called "/ROP," which vets the target addresses of the return instructions to ensure they aren't malicious. Computer scientist and researcher Ivan Fratric of the University of Zagreb in Croatia submitted "ROPGuard," which specifies a set of checks for detecting when certain functions are being called by ROP code. And Vasilis Pappas, a Ph.D. student at Columbia University in New York, created "kBouncer," which detects abnormal control transfers using common hardware features, according to Microsoft.

"Microsoft applauds these researchers who met the challenge and developed defensive solutions that go above and beyond conventional security practices focused on discovering individual issues," said Mike Reavey, senior director, Microsoft Security Response Center. "We can’t wait to see how this initiative will inspire others to explore defensive technology research in order to potentially mitigate entire classes of vulnerabilities."

Critics argued that the contest was merely a way for Microsoft to get others to fix its vulnerability problems. But the winner retains ownership of the intellectual property and grants Microsoft a license to use it. Researchers whose technology isn't selected by Microsoft also still own their intellectual property.

The grand prize is $200,000; second place, $50,000; and third place, an MSDN Universal subscription valued at $10,000.

"The Microsoft BlueHat contest has definitely encouraged my research into protection technologies," DeMott says.

Pappas concurs. "[The BlueHat Prize] motivated me to implement/evaluate this project idea I had. It’s definitely a very good move, especially because it motivates research on practical defenses."

Microsoft will provide more details on the entries at Black Hat, but has posted the abstracts here .

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29445
PUBLISHED: 2021-04-16
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...
CVE-2021-29446
PUBLISHED: 2021-04-16
jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...
CVE-2021-29451
PUBLISHED: 2021-04-16
Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. The issue will be patched in the upcoming 5.2.1 release.
CVE-2021-29452
PUBLISHED: 2021-04-16
a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this ...
CVE-2021-29444
PUBLISHED: 2021-04-16
jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDec...